ExfilSquad status: a vendor validated the group's published data across 13 victim organisations and put the access path on misconfigured Power Pages portals — reversing the assessment, recorded here two weeks ago, that its victim list was more likely fabricated
Status update on the ExfilSquad extortion brand, tracked here since the UK Department for Education portal breaches of late July. Two weeks ago a weekly recorded a threat-intelligence vendor assessing fabrication as the more likely explanation for the group's leak-site victim list — an assessment that sat awkwardly alongside a real, government-confirmed breach inside that same list. This week the balance of evidence moved the other way, and it is worth recording precisely because the earlier scepticism is on this store's record.
Fortra's intelligence team reviewed the archive the group published by torrent on 7 August — 382.64 GB and 27 million records — and concluded that the group's access claims are correct for at least 13 organisations spanning government, education, financial services and manufacturing, with the UK Department for Education and the Police National Legal Database among them (Infosecurity Magazine, 2026-08-14). A second outlet reporting the same validation puts the figure differently, saying researchers are backing claims that the group exfiltrated data from about 15 organisations and naming the Department for Education but not the legal database (Cybersecurity Dive, 2026-08-14); the two counts are not reconciled by either. Two findings inside that review matter more than the count. Fortra reports finding no evidence of a vulnerability being exploited or of ransomware being deployed, and its leading theory for the access path is misconfigured Microsoft Power Pages portals allowing public read access — the same configuration class Switzerland's NCSC put in front of Swiss operators on 4 August, when it advised on anonymous web roles granted excessive Dataverse table permissions (NCSC Switzerland — Cyber Security Hub, 2026-08-04). It also identified over 10,000 potentially publicly accessible Power Pages instances. In the same week a private-sector victim, Wesco International, confirmed it was investigating a CRM data-exfiltration claim while stating it found no evidence of ransomware and does not believe sensitive data is at risk, after its ransom deadline expired and the group published (BleepingComputer, 2026-08-11).
Triage: anonymous data access through a portal produces no intrusion telemetry at all, so the observable is in application and platform logs rather than security tooling. The shape worth looking for is volume and breadth against an unauthenticated role: requests to table or list endpoints from unauthenticated sessions retrieving large record counts, paging steadily through a dataset, or enumerating table names — patterns that distinguish bulk collection from the handful of records a genuine public-facing form needs to serve. Legitimate anonymous use of these portals is narrow and shallow by design; a public form retrieves what it needs to render, not the table behind it.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Persistence TA0003
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Privilege Escalation TA0004
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Stealth TA0005
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Collection TA0009
T1213Data from Information Repositories
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.